by Kastro
Paper/Archive/CVE-2021-42001

CVE-2021-42001

Ping Identity PingID Desktop — PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure

EPSS 0.5%CVSS 9.9
critical.is priorityof 100
38
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 43.2.432 × 208.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.

Affected

ProductAffectedFixed inSource
PingID Desktopunspecified – < 1.7.31.7.3CNA
PingID Desktopunspecified – < 1.7.31.7.3CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Ping Identity (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refpingidentity.com/en/resources/downloads/pingid.htmlrefdocs.pingidentity.com/bundle/pingid/page/dyt1645545885978.html